The SpyPhone – and remote recording

18 10 2007


The project:
How to record a meeting in such a way that even a strip search wouldn’t blow the agents’ cover and also store the recorded intel in such a way that should the agent be compromised, the intel would be safe.

Oh god oh god oh why:
The list of movies in which an agent has his cover blown after the counterpart rips his shirt open to find his body-worn microphone taped to the chest and a tape recorder in his pocket is endless. Afterwards the agent is “disposed of” and the recorded intelligence is lost since the counterpart has obtained the recorder.

And finally I’d like to give a “heads up” to those who fear for industrial espionage or otherwise like to keep somethings secret. Cellphones is probably one of the easiest tools to use for gathering intel either as a dictaphone or a bug as you can read in this article.

Conceiving the project:
The solution to this problem came to me inspired by a newspaper article I saw a while back ago… “Police security was compromised during an arrest, where the police confiscated a cellphone from the perps, and forgot to turn it off. Later, the the perps called the phone which was set to both be silent, but also automatically take the call. Since the phone was stored in the same room where the police spoke of sensitive matters, the perps learned vital and secret information from the police”
Not that I in any way sympathize with the perps, but I must admit it was a rather clever way to place a bug amongst their adversaries.
You can read the article here in Danish “Here”

It occurred to me that the best way to hide the gear was to hide it in plain sight – preferably by using ordinary consumer products to make the illusion more believable. Everyday gadgets that wouldn’t raise suspicion.
Secondly, keep the recorded intel of the agent in case the worst should happen.
This means a transmitter/reciever solution – preferably encrypted. I wanted it to be one-man operated and easy to set up.
To me, the obvious gadgets to use are cellphones as they are easy to come by, they are well encrypted, these days people would take notice if you didn’t carry one and finally cellphones are optimized to the spoken word for clear conversation.

The Transmitter:

Actually there isn’t much to this. The phone the agent is carrying should just be a standard cellphone, although preferably anonymous or boring rather than the newest and shiniest model.

The next thing to give some thought is the position of the microphone.
To get the best recordings one should keep the microphone as close as possible to the source of recording
but without raising suspicion to what you’re doing. In most case scenarios, simply holding the phone casually or otherwise placing it in a good strategically place would be sufficient. However, in some cases it could prove beneficial to connect an external microphone to the phone. This of course is simply done by using a decent “handsfree set” giving the agent the opportunity of hiding the phone in a pocket and the microphone can be placed on the chest as normally done with a covert microphone. One thing I’d recommend is to disable the handsfree set so that any possible noise from from the speaker won’t give away that the phone is “on”.
To do so use a small screwdriver to pry open the little case as shown below.

    When this is done use a wirecutter to disable the speaker…cut the two cables within the orange frame.

    Put it all back together so it looks like it hasn’t been tempered with

The Receiver:
This is where the real fun begins… If our imaginary agency hasn’t got the manpower to have a tactical team sitting in a van outside the building (labeled Otto’s gardener service) with another cellphone and a recording device pressing “record” when receiving an incoming call, then we should automate this task a bit by using the automated answer function imbedded in the phone.
(A little detail you might want to take notice of, is that not all phones have this function)
I used an old SonyEricsson K750 phone kept in my “old gadgets soon to be obsolete” drawer, which has this very function.
Of all the phones I’ve come about with the “automated answer” function, every one of them needs to have a handsfree set connected before this function can be enabled, but since we need a handsfree set to connect the phone to a recorder, this poses no problem.
How to activate the automated answer function is shown below… (It’s actually much the same setup on most phones)

    …and connect the cables to the recorder…

The recorder:
Instead of a finger pressing “record” and “Stop” we’d use the VOX technology (Voice activated recorder) to do just that.
There are various dictaphones and the likes that has this technology build in.
However I’d much prefer to use my Mac for this task. Eventually I’ll be uploading it to the computer anyway for storing or editing.
Setting up the Mac I just needed some software to make it a VOX recorder and fell in love with “AudioCorder” for OSX. (There is an abundance of VOX software on the internet for all OS systems, both for free and demo)
To set up the AudioCorder software do the following:

Set the “Start Trigger Length” to 0.0 Seconds:
(This determines when the recorder should start reacting to incoming sound.)

Select “Buildt-in Input/Line In”:
(Be sure to select the right input.)

Enable VOX:

Trigger Volume Start/Stop:
(Determines what level of volume the recorder should react on to start/stop recording.)

That’s it. You’re all set to play undercover agent.

Materials & Price tag:

Extra cellphone: 100$
Handsfree sets: 40$
Cables & plugs: 5$
Software: Free or Demo

Putting it to real use:
Let’s Imagine we are going to use our new contraption…
The agent turns on his receiver phone, Mac and the Audiocorder software before leaving his safe place.
He catches the first commercial flight across the atlantic and meets up with the target and after a routine security check for suspicious items the meeting begins, the agent calls his receiver phone and the computer starts to record…
… after a while the agent determines that he got the intelligence needed, he ends the call and deletes the outgoing call list in case security should find an interest in his phone.
He leaves… job’s done.





Sniping the security

11 08 2007


The project:
How to remotely disable security cameras nondestructively from quite a distance…

Oh God oh God oh why:
It’s no secret. A lot of my inspiration comes from movies and for quite some time I have become more and more annoyed by Hollywoods sometimes rather silly solutions for an agent to shut down security cameras in order to remain undetected: E.g. blowing up the nearby power-plant or rigging up gadgets in sewers, where they can be detected by renovation workers and the sorts. If you blow something up or otherwise break it, your counterpart will immediately know it is sabotage and rule out a simple technical malfunction.
Another thing that got me to write this article is the abundant usage of surveillance cameras everywhere which makes me want to burst the bubble about security of surveillance cameras by exposing their weakness. Switching point of view will also often lead to improvement…

The basics:
The laser sniper project can basically be split in to three minor projects: The laser and scope with mount, The remote and The switch

Part one: The laser and scope with mount

    For the actual disabling of the camera, I decided to use a standard laser for simply blinding the camera. The simplicity of this construction makes me wanna weep (I think I read somewhere that the best spy gadgets are the simplest). In theory I’ll shoot it through a window using a suction camera mount as base, which also makes my contraption quite small and easy to put up almost everywhere.
    Mount an ordinary sports rifle scope with the laser mounted directly on the scope and then calibrate the two so that the laser dot hits the center of the crosshair.

Part two: The remote

    In the search for a transmitter/receiver solution that had both range and some sort of signal encoding (so others wouldn’t accidently trigger my laser) it hit me: cellphones… they both have potential worldwide coverage, are hardcore encrypted and since they are sold by the billions, they are quite affordable – especially second hand cellphones. So I dug out my Nokia 6280 from my “Cellphone with SLR-lens” project.
    I cracked it open once again…

    Flipped the top over, removed a warranty sticker and opened up, removed the built-in speaker and solded a sound output cable to speaker connectors.

    The next step is done so that the relay on the switch doesn’t sound like Fred Astaire on speed when the phone receives an SMS…
    Set up the phone to play a sound only once when receiving an SMS


I found a single click sound off the internet, uploaded it to the phone and set the phone to use it when receiving an SMS…

Part three: The switch

    What I then needed was a way for the cellphone to communicate with the laser. Since I’m no wizz at making circuits from scratch, I started scavenging the internet for a building kit that would do the job for me and found a Sound switch from Smartkit. This little gizmo reacts to sounds like claps and flips a switch
    I found a small acryllic case and built in the electronics, added a grafite core to filter out electrical noise and two resistors (together 125KO) to weaken the signal a bit. Finally, I gave it an on/off switch.

Putting the pieces together:

    Finally we just need to set up the laser on target, plug it into the switch, plug in the cellphone and you’re all set.

Materials and price tag::

    Hunting scope – 25$
    BB gun Laser – 20$
    Mountings – 15$

    Cellphone – Anywhere form 50$ and up depending on the model and age

    Switch circuit – 25$
    Box – 3$
    Wires, plugs, grafitecore, resistors and other – 15$

Putting it to real use:
Let’s just pretend for a moment that we were actually going to use this setup to enter a building without being seen…
Usually the guys that put up the cameras are clever enough to not just put one camera up to guard an entrance. But they put up several for two reasons; Mainly to get more than one angle on the perps trying to get in, and to make the cameras cover each other so the perps can’t just yank out the power-plug on the cameras…
To get in we’ll need a laser for every camera… (se the drawings below) and a cable-splitter for multiple lasers connected to one switch and cellphone.

And if we’re going to be smart about this… which I’d like to think… then maybe we should take out all the cameras covering the perimeter of the building to make it look like a system failure rather than us trying to get in unseen… just a thought.

Troubled thoughts during the projeckt:
I had some serious thoughts about how to trigger the laser on and off. First, I thought I’d use an old wrist watch as a timer, but ended up discarding that idea… It just didn’t feel right and if the “agent” had to shut down several security cameras, he would not only have to synchronize all the watches and set them up to turn the lasers on at the exact right time at once, but also turn them off after the job. My second idea was to remotely trigger the laser by radio or walkie-talkie. This would give the “agent” the possibility of e.g. pressing the call button on the walkie which would send out a beep to activate the lasers needed.
The problem with this solution is that by using a standard walkie, everybody else could activate the lasers accidently if they where using the same channel (keep in mind that almost all baby-alarms use the standard walkie-talkie frequency). So unless I were to use pro walkie with encryption, I’d have to modify my plans a bit.
In the search for a transmitter/receiver solution that both had range and some sort of signal coding, it hit me: cellphones. But how well will this actually work? Well, after I build this, I had to try it out on an old security camera… Then I had some friends sending it a test-SMS and finally I had someone I knew across the Atlantic do it as well… No problem there, either. It worked like a charm.

The fine print at the bottom…
In case you’ve missed the huge warning sign I’ve put up or choose to disregard it and are thinking about using the knowledge you’ve just gained to be messing with something you shouldn’t… Think about this: Maybe I left some minor, but crucial details out so assholes won’t be messing with something they shouldn’t be messing with… without getting their asses busted

So don’t !!!





Automated BB-gun trigger

14 05 2007


c-h-a-o-s.com Automated trigger.

Inspired by the motion picture “The Jackal”, where Bruce Willis built a mean-ass automated gun (aka turret, aka sentry gun), I have always wanted to build something similar myself.

One of the hurdles I had to overcome was to automate the trigger… Iv’e tried loads of different solutions including electromagnets or weird solutions with strings and a rotary motor.

A major goal in this process is finding a way to get a rapid linear pull when flipping a switch upon which the “finger” should return to its original position… Ready for the next pull…

c-h-a-o-s.com Automated trigger 3pics.

The solution I came up with (as shown in the pictures) was using the linear motor from the central locksystem used in a car. This was mounted on the gun with some pieces of aluminum from a studio rack mount and some parts for mounting a lock on a bike. I added a springcoil on the linear motor so it would go back to its original position. Finally I strung a wire from the “finger” and around back of the handle of the gun, thus making a soft but strong pull to the trigger.

Et voil?. Add 12v to the equation and you’ve got a lightning fast remote trigger and the ability to deploy rapid fire down range.

Be sure to read “The Turret #2″ – Mounting the gun. Coming soon.